Preparing for a DDoS Attack: A Runbook for ISPs and Online Businesses
Distributed denial-of-service attacks are cheap to launch and can take an unprepared network offline for hours. Organisations that recover quickly have one thing in common: they decided what to do before the attack started.
1. Know your normal
Baseline traffic per link, per service and per time of day. Flow data and monitoring make abnormal spikes obvious within minutes.
2. Define detection triggers
- Link utilisation above an agreed threshold
- Sudden spikes in packets per second or new connections
- Traffic from unusual sources, ports or protocols
3. Escalation contacts
Keep current contact details for your upstream providers’ NOCs, your scrubbing provider and internal decision-makers. Test the numbers.
4. Mitigation options in order
- Rate-limit or filter obvious attack traffic at your edge.
- Ask upstreams to filter or use BGP Flowspec where supported.
- Divert traffic to an on-demand scrubbing service.
- As a last resort, use remote-triggered blackhole routing for the targeted IP to protect everything else.
5. Communicate
Prepare status-page and customer messages in advance. Clear, early communication reduces support load and protects trust.
6. Review afterwards
Record what happened, what worked and what to change.
We help ISPs and online businesses build DDoS runbooks and always-on protection. See our DDoS Protection service or plan your defences.
